Extracted

• • Target
    ab19f6099d0f12ef84705e206c4025dfe4262bcf284c37593bdff4d8b0c09236
  • Size 6.4MB
  • SHA256 ab19f6099d0f12ef84705e206c4025dfe4262bcf284c37593bdff4d8b0c09236
  • MD5 106c427dc45271b24efa6a7ad8072c0e
  • SHA1 6c7e7df675980d18b9155a202ed5047d1d8a6ad7
  • SHA512 b3f3566813fee89d2cb82aa5e4d4fdcce5ec2bdb5136944bfe33f605183a4ffbd3b908177fc254a599b292f66c939c0c1b6f003c35061a2cc091bcdc70544996
  • SSDEEP 98304:vVKi95iSRGHJRsncE+5bj7UCXFoFuudYuRQ4/By:vUCryRpE+lj7UCVoFulwBy
  • TLSH
    T13766BF42BB8F8936D4C57A7412AB9324F634AC6C936152DB0A05D230BD673E57F3A7C2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bankercollectioncredential_accessdefense_evasiondiscoveryevasionoctoimpactinfostealerpersistencerattrojanstealth

  • Family: Octo

    Octo is a banking malware with remote access capabilities first seen in April 2022.

    bankertrojaninfostealerratocto

  • Octo payload

  • Removes its main activity from the application launcher

    stealthtrojanevasion

  • Loads dropped Dex/Jar

    Runs executable file dropped to the device during analysis.

    evasion

  • Makes use of the framework's Accessibility service

    Retrieves information displayed on the phone screen using AccessibilityService.

    collectiondefense_evasioncredential_access

  • Obtains sensitive information copied to the device clipboard

    Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.

    collectioncredential_accessimpact

  • Queries a list of all the installed applications on the device (Might be used in an attempt to overlay legitimate apps)

    bankerdiscovery

  • Queries the phone number (MSISDN for GSM devices)

    discovery

  • Acquires the wake lock

  • Makes use of the framework's foreground persistence service

    Application may abuse the framework's foreground service to continue running in the foreground.

    defense_evasionpersistence

  • Queries the mobile country code (MCC)

    discovery

  • Queries the unique device ID (IMEI, MEID, IMSI)

    discovery

  • Reads information about phone network operator.

    discovery
  behavioral1behavioral2